Release notes: Vibgrate CLI 2026.930.1 — YAML config and safer review --base

[vibgrate-team]

What's new in 2026.930.1

Shipped 30 Sep 2026 (GitHub release 1 Oct 2026). Full release: https://github.com/vibgrate/cli/releases/tag/v2026.930.1 · Changelog: https://vibgrate.com/changelog/cli/2026.930.1

Headline: YAML config lands, and vg review --base trusts the base branch

You can now keep settings in .vibgrate/config.yml alongside vibgrate.config.json — including driftBudget and your review policy — so local-first config stays easy to edit and review in PRs. The first vg review writes its starter policy into that YAML instead of a separate review.toml.

Security-wise: vg review --base now reads team review files from the base branch, so a pull request cannot hide findings by shipping a looser policy. A base without a review policy falls back to standard settings rather than whatever the PR added.

Also in this cut

New

• Settings from .vibgrate/config.yml (with driftBudget + review policy)

Improved

• Local reviews without --base still use the files on disk

Changed

• Starter review policy goes into YAML config (not a separate review.toml)
• Base branch without a review policy → standard settings (not PR-added ones)

Fixed

• Existing review.toml files keep working; vg doctor warns when a config file is ignored

Security

• vg review --base loads team review files from the base branch so PRs cannot suppress findings

Try it

npm install -g @vibgrate/cli
vg --version   # expect 2026.930.1-class build
# Optional: add .vibgrate/config.yml with driftBudget / review policy
vg review --base main
vg doctor      # surfaces ignored config if something is skipped

No-install try: npx @vibgrate/cli scan

Benchmarks (honest)

Two-arm benchmark vs 2026.921.1 on the pinned corpus (236 metrics compared). Extraction held steady (19 languages, locate accuracy 0.94, dependency detection 0.96). Startup median was essentially flat (~451 → ~454 ms). We published regressions too — tasks passed on both arms 36 → 34 (−5.6%) and comparable-task rate 0.95 → 0.89 (−5.6%). Details: https://vibgrate.com/cli/benchmarks

Discuss

• Migrating from review.toml or JSON-only config to YAML? Tell us what was smooth / confusing.
• Using vg review --base on real PRs — did the base-branch policy load match what you expected?
• Docs gaps for config or review? Prefer a good first issue or reply here.
• Roadmap thread: Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144

— maintainers (vibgrate-team)